[dekobon]

Fixes #1710. Fixes #1726. Deferred scope widening: #1728.

Two commits. The first makes the quarterly mutation-testing gate able to fail; the second makes it able to finish.

6b147d13 — the alias, and three defects behind it (#1710)

The cargo mutants alias in .cargo/config.toml expanded to a command of its own name, which cargo has rejected as recursive since 1.56 — it never worked. Investigating it turned up three more defects in the same path, none of which had ever produced a red job:

Defect	Effect
cargo mutants … | tee under GitHub's default bash -e (no pipefail)	The 2026-10-01 run died on the alias error after 68 s and was reported success (138-byte artifact)
Issue step read target/mutants/missed.txt	cargo-mutants nests mutants.out/ under --output; that path is never written, so no outcome could ever file an issue
-f src/metrics/	A -f glob containing / is whole-path matched; it selected no file
--in-place -j 2	clap conflict; would have failed the instant the alias error was gone

Fix: alias removed; .cargo/mutants.toml with minimum_test_timeout, output, and test_package = [root, ast] so a checker/getter mutant is judged by the root crate's metric tests; workflow sets pipefail, selects src/metrics/**/*.rs, reads the nested path.

96a45849 — sharding (#1726)

The repaired glob selects 3812 mutants where the broken one selected 196; serial in-place at the measured ~8 s/mutant is ~8.5 h against the 6-hour hosted-runner cap, and a cancelled step is not failure(), so a timeout would have filed nothing.

Three jobs: prepare declares the shard list once; mutants runs an 8-shard round-robin matrix with a pinned cargo-mutants@27.1.0 (every shard must generate the same list for the partition to be disjoint); report aggregates. The design point that survived three review rounds: each shard writes one shard-summary-<k>.json after cargo-mutants returns, joining the captured exit status to the result files at the source. A cancelled, crashed, or timed-out shard never reaches that line, so "no summary" reads downstream as "not complete" by construction. The summarizer refuses the combinations cargo-mutants cannot produce — exit 0 beside escapes (a masked status), exit 2 beside timeouts, and a complete exit with zero mutants tested (the #1710 empty-selection shape). The report names non-complete shards rather than counting them, uploads its body as an artifact before any gh call, and comments on an open issue by a fixed title instead of filing siblings.

Both halves are utils/mutation-report.py, under make mutation-report-test (40 cases) in make pre-commit / make ci, with a ci.yml explicit twin and a pre-commit hook — lesson 80 applied to the workflow that proved it.

Verification (cargo-mutants 27.1.0; each item names its command; the workflow-shell harness is now in-tree as utils/mutation-workflow-test.py, #1731)

• Eight round-robin shards: 477×4 + 476×4, pairwise disjoint, union = the 3812-line list, 24–25 ast-crate mutants each (slice would put all 196 in the last shard).
• All four run: bodies executed under bash -e with stub cargo/gh; step exit equals cargo-mutants' in every case; removing pipefail makes the summarizer refuse.
• Every refusal and report branch perturbed; each fails exactly its one guarding test.
• make pre-commit: BCA_GATE: pass on both commits.
• Reviews: three on the first commit, four parallel plus two astra verification passes on the second; all findings folded in.

Known limits

• Per-shard wall time is unmeasured. Dispatch the workflow once after merge; the doc's rule is to raise the count in prepare if any shard's step passes ~200 of its 270 minutes.
• A re-run shard that fails before uploading keeps its earlier attempt's summary, indistinguishable from a shard not re-run. The body names mixed attempts; closing this needs per-shard API calls from the report job.
• Expect the first completed run to file a large issue: no run has ever filed one, so it reports the accumulated backlog, not a regression.